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^plQ/rS^^fffi 2005 

MARKED-UP SUBSTITUTE SPECIFICATION 

DoccriDtion TITLE OF THE INVENTION 

METHOD FOR OPERATING A TERMINAL DEVICE^ IN^A-RADIO COMMUNICATION 
SYSTEM , A RAD I O COMMUN I CAT I ON SYSTEM, A TERMINAL DEV I CE AND A 
CONFIRMATION UNIT FOR A-RADIO COMMUNICATION SYSTEM 

CROSS REFERENCE TO RELATED APPLICATIONS 

rO0011 This application is based on and hereby claims priority to European Application No. 
02019449.4 filed on August 30, 2002. the contents of which are hereby incorporated by 
reference. 

BACKGROUND OF THE INVENTION 

[0002] The invention relates to a method for operating a terminal device in a radio 
communication system, a radio communication system, a terminal device and a confirmation 
unit for a radio communication system. 

[0003] In radio communication systems, data transmission from radio stations takes place by 
way of an air interface. Known radio communication systems are for example wireless local 
networks (WLAN, Wireless Local Area Network) and also mobile radio systems, for which 
numerous standards are known. In Europe, first and foremost GSM is known as the standard 
for the second generation of mobile radio and UMTS as the standard for the third generation of 
mobile radio. The concept of so-called reconfigurable terminal devices is known in particular in 
mobile radio systems. These are reconfigured by moans of software downloads executed by 
way of their air interface. Updating of their operating system can take plac o by this means , as a 
result of which for example even a deployment in mobile radio systems is possible, of which the 
terminal device was not capable prior to the reconfiguration. Since errors can occur during the 
aforementioned reconfiguration of the terminal devices, errors which affect the operation of the 
terminal device in such a way as to have a detrimental effect on the overall operation of the 
radio communication system (by signals being transmitted by an incorrectly reconfigured 
terminal device in power ranges which are not normally permitted or using formats which are not 
normally permitted, for example), a method is known whereby a check is performed during 
operation of such terminal devices on the signals transmitted by them. In this manner it is 
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possible to recognize whether the signals correspond to normal operating conditions. Should 
this not be the case, the terminal device can be recognized as being defective on account of the 
errors detected and removed from the radio system. 

[0004] The method just described has the consequence that negative influences of an 
incorrectly configured terminal device on the communication system in which it is being 
operated are only avoided if the check performed on its signals or its functional integrity while it 
is operating has produced a corresponding negative result. 

SUMMARY OF THE INVENTION 

[0005] Tfre-An object of the invention is to reduce the probability of a radio communication 
system being influenced by incorrectly functioning terminal devices. Th i s objoct i s achioved by 
a method accord i ng to cla i m 1 , a radio commun i cat i on systom according to cla i m 11 , a tormina ! 
dev i c e accord i ng to cla i m 12 and a l so a conf i rmat i on un i t for a radio commun i cation syst e m 
accord i ng to c l a i m 13. Advantagoous embod i m e nts and d e v el opmontc of tho inv e nt i on are s e t 
down i n depondont c l aims. 

[0006] Tbe-^method according to an aspect of t he invention for operating a terminal device 
in a radio communication system provides that the terminal device is only authorized for 
operation in the radio communication system if a confirmation is present to the effect that the 
terminal device will be checked for proper functional integrity while it is operating. This allows 
the terminal device to be deactivated already prior to carrying out the actual check on the 
functional integrity of the terminal device. For if it is not possible to guarantee a subsequent 
check of the functional integrity, it is not possible to decide whether the terminal device is 
functioning correctly or not. Since unrecognized defects in the terminal device can have 
extremely disadvantageous effects on the radio communication system, its operation is actually 
prevented where it is determined that the intended check can not be properly carried out. 

[0007] Advantageously, tbe-a_method according to an aspect of t he invention is implemented 
immediately during or shortly after commissioning of the terminal device in the communication 
system. Bv th i s m e ans Thus , a negative influence on the radio communication system in the 
case of a defect in the terminal device is prevented as early as possible. It is however 
alternatively possible to implement the-a_method according to an aspect of t he invention for the 
first time while the terminal device is actually in operation or also to implement the method 
repeatedly, periodically for example. In either case toe-amethod according to an aspect of t he 
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invention has the advantage that negative influences of a defective terminal device on the 
communication in a radio communication system are not prevented only at the time when a 
corresponding check of the functional integrity of the terminal device has been performed. This 
can rather happen as soon as it has been determined that the desired checking of the functional 
integrity can not be guaranteed. This can be the case for example when a functional problem in 
the communication system or in the units provided for the checking renders proper checking 
impossible. However, this can also be the case for example when insufficient resources are 
available at the current point in time in order to implement the check. 

[0008] In accordance with a development of the invention, a confirmation signal is provided 
which, in the event of its being transferred to the terminal device, specifies that the terminal 
device will be checked while it is operating. With regard to this development, the terminal 
device is authorized for operation in the communication system by the confirmation signal being 
sent to the terminal device. In this manner it is possible to advantageously achieve the situation 
whereby operation of the terminal device is prevented automatically if the confirmation signal is 
not transferred. 

[0009] In accordance with a development of the invention, prior to its authorization for 
operation in the communication system the terminal device sends a request signal to a 
confirmation unit, whereupon the confirmation unit initiates the checking of the terminal device 
and sends the confirmation signal to the terminal device. The radio communication system 
learns of the existence of the terminal device from the request signal and can make available 
the resources required for checking the functional integrity of the terminal device, which is 
signaled by the confirmation signal sent by the confirmation unit. 

[0010] For sending the request signal to the confirmation unit the terminal device advanta : 
geously uses an address stored previously in the terminal device, which address is predefined 
for use by a plurality of terminal devices at least in this communication system. This makes it 
possible for the request signal from the terminal device to also actually reach the confirmation 
unit. In this situation the address of the confirmation unit used for this purpose may have been 
stored in the terminal device either during the actual manufacture of the terminal device or 
alternatively during a subsequent configuration of the terminal device by means of a software 
download. However, it is also possible for the address to have been notified to the terminal 
device by means of a broadcast signal from the respective radio communication system. In 
both the formerly mentioned cases it is advantageous if the address of the confirmation unit is 
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suitable for use in more than one radio communication system. If the terminal device is then 
able to initiate a communication in this plurality of communication systems, it can request an 
authorization by way of its request signal for its operation in the communication system already 
at the time of its commissioning by transmitting the same address in each case without 
additional knowledge of details of the respective communication system. 

[001 1] In accordance with an advantageous development of the invention, the terminal 
device only sends the request signal after a predefined period of time has elapsed following a 
registration performed by the terminal device with the communication network, during which 
period of time it has not already automatically received the confirmation signal. In this case 
registration is understood to be a procedure in which the terminal device provides the 
communication system with a knowledge of its existence. The communication system is then 
able to confirm automatically to the terminal device the check on the functional integrity of the 
terminal device that is to be performed subsequently without the request signal needing to have 
been transmitted previously. Such a procedure is possible particularly in radio communication 
systems which are operated by a system operator that is responsible for the necessary 
checking. System operators of this type exist in tho convontiona l known mobile radio systems 
such as GSM for example and in the planned UMTS. There are however no system operators 
in the radio communication systems with decentralized organization such as WLAN for example 
or so-called self-organizing systems or ad hoc systems such as Bluetooth for example. If the 
terminal device is situated in one of the latterly mentioned systems, it will not be able to receive 
an automatic confirmation signal because of the lack of a central entity which could initiate the 
necessary check. After the aforementioned period of time has elapsed, such a confirmation 
signal is no longer expected to arrive (the terminal device can thereupon conclude that it is 
located in a communication system with no system operator), with the result that the terminal 
device then sends out its request signal. The latter can, through use of the relevant address of 
the confirmation unit, also advantageously be forwarded in a network with a decentralized 
organization specifically to an appropriate service provider that initiates the desired check and 
sends the confirmation signal to the terminal device. 

[0012] In accordance with a development of the invention, a plurality of devices are capable 
of performing checking of the terminal device for proper functional integrity while it is operating. 
Advantageously, prior to performing the check the method determines which of these devices is 
performing the checking of the terminal device. It is then possible to flexibly assign the 
resources of the available devices which basically come into consideration for the check, also in 
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the case of a large number of terminal devices for which the described check is to be 
performed, to the terminal devices. 

[0013] Determining which device performs the check is advantageously carried out in such a 
way that the device is located in closest possible proximity to the terminal device. This achieves 
the result that signals to be transferred during checking between the terminal device and the 
device used for performing the check have only relatively short paths to travel, which means 
that minimal loading is imposed in total on the capacities of the communication system by these 
additional signals. 

[0014] Alternatively, the terminal device itself can be defined as the device for performing the 
check, with software needed for performing the check being delivered to the terminal device by 
way of an air interface. With regard to this embodiment of the invention, the signals produced 
by the terminal device are actually checked by the terminal device itself prior to their transmis : 
sion over the air interface. Bv moanc of Using a software download over the air interface, the 
program can be continuously updated for performing the check and can be adapted to the 
relevant communication system in which the terminal device is currently located. The afore- 
mentioned program can even be selected depending on a current location of the terminal device 
in the communication system. 

[0015] In accordance with a development of the invention, during checking of the terminal 
device, signals to be transferred by the latter are checked for compliance with at least one 
particular quality criterion whose value is dependent on where the terminal device is situated 
within the radio communication system. Certain maximum permissible delay times or maximum 
permissible transmit power values, for example, come into consideration as the quality criterion. 
As a result of the aforementioned location-dependent differing implementation of the checking of 
the terminal device, it is possible to advantageously take into consideration the fact that varying 
degrees of compliance with quality criteria can perfectly well be necessary in one and the same 
communication system. For example, in areas of a communication system in which a high traf- 
fic density is normally the case the requirements concerning the signal quality to be observed or 
concerning the freedom from errors of the terminal device in question are more demanding than 
in areas where a low traffic density is normally the case. In the first-mentioned case the 
influence of strong noise signals is made more serious by a possibly defective terminal device 
than in the last-mentioned case. 
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[0016] In accordance with a further development of the invention, after authorization of the 
terminal device for operation, the further operation of the terminal device in the communication 
system is then only subsequently refused if the check on the terminal device for proper 
functional integrity during operation has yielded a certain number of errors or an error which 
exceeds a particular threshold value. This procedure makes it possible to authorize further 
operation of the terminal device in the situation where although errors are detected they can 
however still be tolerated with regard to operation of the overall communication system. Only 
when the number of errors or the severity of the error can no longer be tolerated with regard to 
operation of the communication system will the terminal device be excluded from further 
operation. Tho rad i o commun i cat i on system according to th e i nv e ntion, tho tormina l dov i ce for 
a radio commun i cation system and also th e conf i rmat i on un i t for a radio commun i cat i on system 
accord i ng to tho dopondont c l a i ms oompr i so tho components r e quir e d for th e d e scr i bod mothod 
and ar e dos i gnod for imp l om e nt i ng tho mothod i n an appropriat e mann e r. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0017] Tfre These and other objects and advantages of the present invention will be 
d e scr i b e d i n detai l i n become more apparent and more readily appreciated from t he following 
w i th r e f e r e nc e to description of the exemplary embodiment s r e pr e sentod i n the f i gures , taken in 
conjunction with the accompanying drawings of which: 

Figure 1 shows -is a block diagram of a part of a radio communication system according 
to the invention, 

Figure 2 show s is_a schematic representation of the sequence of the method according 
to the invention for the radio communication system shown in Figure 1 , 

Figure 3 shows is_a flowchart for implementing a check on a terminal device within the 
communication system shown in Figure 1 , and 

Figure 4 shows -is a block diagram of t he terminal device from injhe radio 
communication system shown in Figure 1. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

[0018] Reference will now be made in detail to the preferred embodiments of the present 
invention, examples of which are illustrated in the accompanying drawings, wherein like 
reference numerals refer to like elements throughout. 
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[0019] Figure 1 shows a part of a radio communication system WLAN; GSM. In this radio 
communication system is situated a terminal device MS taking the form of a mobile user station 
which can be configured by way of an air interface by transferring corresponding software such 
that it can be operated in communication systems based on different standards. The communh 
cation system can be either a centrally organized system for which a system operator is 
present, as is the case for example with the GSM system. The communication system WLAN 
can however also be a non-centrally organized system for which no system or network operator 
is present, as is the case for example with ad hoc networks. The terminal device MS 
considered here can be operated in both types of radio systems. 

[0020] The communication system WLAN; GSM has a network access station AP; BS which 
in the case of the ad hoc network WLAN is normally referred to as access point AP and in the 
case of a GSM network as base station BS. The network access station AP; BS is connected to 
a confirmation unit CU whose function is described in further detail in the following. The 
confirmation unit CU compris e s includes a plurality of geographically separated components 
SC, SP, SP'. One of these components is a checking center SC. In addition, the confirmation 
unit CU has two checking devices SP, SP'. The checking center serves to select one of the 
checking devices in order to implement a check on the terminal device for proper functional 
integrity. The checking devices SP, SP' serve to implement a corresponding check on the 
terminal device MS, provided they have previously been designated for this purpose by the 
checking center SC. The units SC, SP, SP' within the confirmation unit CU can be made 
available by one or more different service providers in each case. If the radio communication 
system shown in Figure 1 is a GSM network, the components SC, SP, SP' of the confirmation 
unit CU are preferably components of the radio communication system. If the communication 
system is an ad hoc network or another system without a system operator, at least the checking 
center SC and preferably also the checking devices SP, SP' are made available through special 
service providers which the terminal device MS can access by way of the communication 
system WLAN. 

[0021] The checking center SC in Figure 1 can also determine that the terminal device MS 
will check its own functional integrity. To this end the checking center SC sends appropriate 
checking software SW by way of the network access station AP; BS over the air interface to the 
terminal device MS. The software SW then enables the self-initiating checking of the terminal 
device MS. 
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[0022] The functional integrity of the radio communication system WLAN; GSM shown in 
Figure 1 is described with reference to Figure 2. In this situation the individual mothod st e ps 
operations are consecutively numbered with the digits 1 to 10 in Figure 2, to which reference is 
made in the following. Figure 2 shows from left to right mothod stops operations which are 
executed by the different components of the radio communication network WLAN; GSM shown 
in Figure 1 . From left to right in Figure 2 these components are the terminal device MS, the 
network access station AP; BS, one of the checking devices SP and also the checking center 
SC. In a first step, a reconfiguration of the terminal device MS is initiated. In a second step, the 
terminal device MS initially waits for a time period t to determine whether it receives a 
confirmation signal from the radio communication system WLAN; GSM indicating that the 
terminal device will be checked for proper functional integrity while it is operating. Such a 
confirmation signal, which is denoted by S2 in Figure 1, is however only generated automatically 
by the communication system if this is one having a system operator, in other words the GSM 
network GSM in the present case. In such a case, the third step described in the following 
would be skipped and the method continued immediately with the fourth step. In Figure 2 it has 
been assumed however that the terminal device MS is currently situated in the ad hoc network 
WLAN. Since in this case there is no central system operator, during the time period t the 
terminal device MS does not receive a confirmation signal S2 from the network access station 
AP; BS of the radio communication system. In a third step after the time period t has elapsed, 
the terminal device MS therefore sends a request signal to the checking center SC. The 
request signal S1 which the terminal device MS sends to the network access station AP; BS is 
shown in Figure 1 . From there it passes to the checking center SC, whereby the terminal 
device MS uses an address ADR of the checking center SC, which address has previously been 
stored in the terminal device MS. In response to the request signal S1 , checking center SC 
determines in a fourth step that the checking device SP is to perform checking of the terminal 
device MS for proper functional integrity. The checking center SC selects the particular 
checking device SP which is situated closest to the network access station AP; BS or to the 
terminal device MS. 

[0023] In a fifth step, the checking devices SP selected by the checking center SC sends a 
confirmation signal to the network access station AP; BS which in a sixth step passes on the 
confirmation signal S2 (cf. Figure 1) to the terminal device MS. After receiving the confirmation 
signal S2, the terminal device MS continues its operation. 
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[0024] If the terminal device MS were not to receive a confirmation signal S2 that would 
amount to the same thing as there having been no authorization for operation issued to the 
terminal device and the terminal device MS would deactivate itself. 

[0025] In a seventh step, the air interface A between the terminal device MS and the network 
access station AP; BS is checked by the checking device SP in respect of correct signals of the 
terminal device MS. If errored behavior of the terminal device MS is subsequently detected in 
an eighth step by the checking device SP, this is notified to the network access station AP; BS in 
a ninth step, whereupon a reconfiguration of the terminal device by moans of a software 
download takes place in a tenth step in order to recover the error. The ten steps described can 
then be executed again. 

[0026] Figure 4 shows the terminal device MS from Figure 1 . In addition to a transmit device 
MSTX and a receive device MSRX for transmitting and receiving signals, the terminal device 
MS compr i s e s includes a processor MSP for controlling its functions. Furthermore, it has a 
timer T for measuring the time period t as per the second step from Figure 2. Furthermore, the 
terminal device MS contains a memory in which the address ADR of the confirmation unit CU or 
of its checking center SC is stored. In addition, a deactivation unit DA is present which effects 
the described deactivation of the terminal device MS when either no confirmation signal S2 is 
received by way of the receive device MSRX or a special deactivation signal is received which 
is the case in the event of an error in the functional integrity of the terminal device MS detected 
by checking duration operation. 

[0027] The checking devices SP, SP' and also the checking center SC in Figure 1 have 
receive devices and transmit devices for receiving and transmitting the corresponding signals, 
and also have a processor in each case which is used for controlling them. 

[0028] According to Figure 3, during commissioning of the terminal device MS from Figure 1 
the method for generating the confirmation signal S2, as described according to Figure 2, is first 
initiated (block 100). In block 100a a check is performed to determine whether the confirmation 
signal S2 has been sent to the mobile station MS. If this is not the case, the terminal device MS 
automatically deactivates itself (block 100b). If this is the case, however, the check of the 
functional integrity of the terminal device MS is performed while it is operating (block 101). In 
the event of an error occurring, is check is first made to determine whether the error is 
recoverable (block 102). The reason why the terminal device MS is not also deactivated 
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immediately in the event of an unrecoverable error consists i n th e fact isjhat the requirements 
relating to freedom from errors of operation of the terminal device MS can change as a result of 
a possible movement of the terminal device MS in the radio communication system at a later 
point in time (for example on leaving the current cell of a cellular mobile radio system and 
entering a new cell). 

[0029] If the error is recoverable, the error is recovered by moanc of a ppropriate instructions 
from the checking device SP to the terminal device MS (block 103). This is done by placing the 
terminal device MS in a corresponding operating state. If the detected error is not recoverable, 
however, the existing connection of the terminal device MS, over which the signals S are sent in 
Figure 1 , is interrupted (block 1 04). A comparison of the current check results from the 
checking device SP with older measurement results which the checking device SP has already 
determined previously for the same terminal device MS is then performed (block 105). In this 
situation, an investigation is carried out as to whether multiple instances of the same error have 
already occurred and whether in this case a previously defined number of the same error has 
already been exceeded. Alternatively, instead of the comparison with errors which have already 
occurred previously it is also possible to check the severity of the error (block 106). The number 
of permissible errors or the severity of the error which can still just be tolerated depends on 
where the terminal device MS is currently situated within the communication system WLAN; 
GSM. The current position can be ascertained for example by way of an appropriate Location 
Service Provider or by utilizing Mobility Management information. If the terminal device MS is 
located for example in a private environment (the user's apartment) or in an environment with a 
generally low traffic volume, the requirements concerning the freedom from errors for operation 
of the terminal device MS can be less demanding than in areas with high demands on the 
reliability of operation or having a high traffic volume. 

[0030] If this interrogation determines that the predefined number of errors has not been 
exceeded or that the severity of the error still lies within the tolerable range, the terminal device 
MS remains authorized for further operation and is placed in a standby mode (block 107). 
However, if the specified error count has been exceeded or if the severity of the error is not 
longer tolerable, the terminal device MS is deactivated by moans of an appropriate signal from 
the checking device SP (block 108). 

[0031] In order to determine errors which occur during operation of the terminal device MS, 
the checking device SP can check the signals S sent out by the terminal device MS for 
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compliance with protocols which are defined by the standard applying to the respective 
communication system WLAN; GSM. 

[0032] The checking center SP shown in Figure 1 also has the capability to define the 
terminal device MS itself for performing the check for proper functional integrity instead of the 
checking device SP, SP. For this purpose, the checking center SC can download appropriate 
checking software SW by way of the network access station AP; BS to the terminal device MS. 
The terminal device MS then utilizes this checking software SW in order to perform its own 
checking. 

[0033] The address ADR of the checking center SC used for transmitting the request signal 
S1 is advantageously valid for all possible communication systems in which the terminal device 
MS can be operated (for example, after it has been made fit for use by m e ans of appropriate 
software downloads for such types of systems in each case). The address ADR can for 
example be a particular telephone number valid for all communication networks. Such an 
address ADR would then be comparable with the emergency telephone numbers commonplace 
today which are standardized in a great diversity of mobile radio systems. In Germany, for 
example, this emergency number is "112". 

[0034] The invention is suitable for use in any desired terminal devices MS which can be 
reconfigured by m e ans of software downloads. It is suitable for use in any desired radio 
communication networks in which such types of reconfigurable terminal devices can be used. 

[0035] It is also possible that instead of only one checking device SP a plurality of checking 
devices SP, SP' and also possibly the terminal device itself MS simultaneously perform checking 
of the functional integrity of the terminal device MS while it is operating. This is likewise defined 
by the checking center SC. In this situation, any of the units involved in such a check can 
monitor or check certain parameters or protocol messages of the terminal device MS assigned 
to it by the checking center SC. 

[0036] Apart from being performed under the aspect of minimizing the data traffic in the 
overall communication network, the selection of the checking device SP performing the check 
by the checking center SC can also be performed under the aspect of distributing the compute- 
intensive checking measures evenly between the available checking devices SP, SP'. 
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[0037] The invention has been described in detail with particular reference to preferred 
embodiments thereof and examples, but it will be understood that variations and modifications 
can be effected within the spirit and scope of the invention covered by the claims which may 
include the phrase "at least one of A, B and C" as an alternative expression that means one or 
more of A, B and C may be used, contrary to the holding in Superpuide v. DIRECTV, 
69 USPQ2d 1865 (Fed. Cir. 2004). 
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